Lovable lets enterprises run apps in their own AWS account

What runs in the customer's AWS account

Until now, Lovable apps ran on Lovable's infrastructure. According to the company, that works for most teams, but some apps rely on data that must stay inside a company's network, and some security teams require every production workload to run in an account they own.

With Deploy on AWS, everything an app needs to run lives in a dedicated VPC in the customer's account. Lovable lists the following components:

• The Lovable data plane on an Amazon EKS cluster, including the preview sandboxes where builds run
• Published apps, with static assets in Amazon S3 and dynamic requests handled by AWS Lambda
• The app database on Amazon Aurora PostgreSQL, plus app storage in Amazon S3
• Application logs, which can be sent to systems such as Amazon S3 or Amazon CloudWatch
• The connector gateway and the secrets for integrations

Apps reach internal systems such as a data warehouse or CRM over VPC peering, so those systems stay off the public internet. Lovable says it installs, manages and updates everything it deploys, so customers do not have to run it themselves.

The company gives an example: an HR team wants a leave planning app that needs data from the HR system, and company policy says that data cannot leave the environment. If the app runs in another provider's cloud, it would not pass review. With the workspace in the customer's own AWS account, the app and its data stay there.

Setup, access and data protection

Hosting on Lovable remains the default, and the company calls it the right fit for most apps. Many organizations will likely run both, Lovable says, with one workspace in their own AWS account for sensitive data and the rest hosted by Lovable.

To set it up, an admin creates a new Enterprise workspace and chooses to host it in AWS. Lovable generates a CloudFormation stack for the customer's account, which the customer's team reviews and runs. The stack creates the VPC, an EC2 instance for the Lovable runner, and the permissions the runner needs. The runner then sets up the EKS cluster, Aurora PostgreSQL, S3 and other services.

The runner is how Lovable manages the installation while the customer keeps visibility into what it does. It uses separate IAM roles for setup, day-to-day maintenance and decommissioning, and Lovable's runner endpoint is the only external host it talks to. Each update is a versioned Helm chart that points to signed container images in the customer's container registry. Existing Enterprise controls still apply, including SSO and SCIM, publishing limited to workspace members by default, a security scan on every build, and audit logs.

On data protection, Lovable describes three layers:

• In the customer's account: app data stays in the VPC, under the customer's own AWS encryption and access controls.
• Between the account and Lovable: components connect out to Lovable over an mTLS-encrypted tunnel, and Lovable never needs an inbound connection into the customer's network.
• With Lovable: chat and project history are encrypted at rest. With bring your own key, admins connect their own AWS KMS key in Workspace settings and can revoke Lovable's access at any time.

Some parts stay with Lovable's multi-tenant service: the editor, the agent, chat and project history, and workspace settings, identity and billing. AI model requests made while building are still processed by Lovable's AI service.

First customer and availability

Lovable says Deutsche Telekom went live in October with its Lovable apps running in its own AWS account. In a statement included in the announcement, the company said its most sensitive workloads require apps and data to stay strictly within its own network, and that running Lovable in its own infrastructure through AskT, its internal AI productivity platform, lets employees build tools connected to internal data while the security team keeps full oversight. It said it is working with its Global HR team on platforms for employees and is the first global enterprise to deploy Lovable this way.

Deploy on AWS is available in private preview for select Enterprise customers. Lovable notes that some features available when hosting on Lovable are not yet supported, and says it is working toward full feature parity. Interested customers can talk to their account team or email [email protected]. Lovable suggests starting with the apps a team wants to build and what its policies require for where they run.

For enterprises with strict data residency or security rules, the option could remove a barrier to using Lovable for production apps that touch internal systems, while the rest of the workflow stays unchanged. Because it is a private preview with feature gaps, broader availability and parity with Lovable-hosted workspaces remain to be seen.